The Cyber Resilience Act1 (CRA) establishes horizontal cybersecurity requirements for products with digital elements (PDEs) made available on the Union market. Its main obligations will apply from 11 December 2027 to almost all economic sectors in the European market. From that date, manufacturers placing PDEs on the market must ensure that those products meet the applicable essential cybersecurity requirements, complete the relevant conformity assessment and provide vulnerability support throughout the support period. The railway sector is characterised by interconnected systems with service lives often exceeding 20 years and governed by harmonised interoperability requirements, with upgrades and extensions needing to maintain compatibility with the existing network or allow for a gradual transition. This poses an undeniable additional challenge for the railway sector in implementing the CRA.